PT-2022-22116 · Tinyexr+2 · Tinyexr+2

Sleicaspero · Published 2022-06-22 · Updated 2025-12-04 · CVE-2022-34300

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions tinyexr version 1.0.1

Description The issue is a heap-based buffer over-read in the tinyexr::DecodePixelData function.

Recommendations For tinyexr version 1.0.1, consider disabling the tinyexr::DecodePixelData function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2022-34300

USN-7913-1

Affected Products

Linuxmint

Ubuntu

Tinyexr

References · 21

• 🔥 https://github.com/syoyo/tinyexr/issues/167 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JFCXR2EJGIE24DV45AWX6JJM7RQAT5CY · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-34300 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-34300 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-34300 · Security Note
• https://ubuntu.com/security/CVE-2021-46143 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7913-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34300 · Security Note
• https://ubuntu.com/security/CVE-2018-16981 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-34300 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I4YMGAN6AV4H4HPDINUHBKX7XE4T5THF · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34300 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-34300 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSGENQ3UEQ6QEKW45FLZFGXPCD5IHXFM · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LQCZL36LTOHWCQ25R5WTRSD5QMM436Q6 · Vendor Advisory